CVE-2021-22272
Description
The vulnerability origins in the commissioning process where an attacker of the ControlTouch can enter a serial number in a specific way to transfer the device virtually into her/his my.busch-jaeger.de or mybuildings.abb.com profile. A successful attacker can observe and control a ControlTouch remotely under very specific circumstances. The issue is fixed in the cloud side of the system. No firmware update is needed for customer products. If a user wants to understand if (s)he is affected, please read the advisory. This issue affects: ABB and Busch-Jaeger, ControlTouch
How to fix
- abb mybuildings2021-05-03 or later
- busch-jaeger mybusch-jaeger2021-05-03 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| abb mybuildings | v < 2021-05-03 | 2021-05-03 |
| busch-jaeger mybusch-jaeger | v < 2021-05-03 | 2021-05-03 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.